gravity-cli 0.4.2__tar.gz → 0.4.4__tar.gz

gravity_cli-0.4.2/README.md → gravity_cli-0.4.4/PKG-INFO

@@ -1,3 +1,20 @@
+Metadata-Version: 2.5
+Name: gravity-cli
+Version: 0.4.4
+Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.12
+Requires-Dist: gravity-schema==0.4.4
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: keyring>=25.0.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: rich>=13.9.0
+Requires-Dist: typer>=0.15.0
+Requires-Dist: uv>=0.8.0
+Description-Content-Type: text/markdown
+
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -625,7 +642,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
-| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key or password: masked, sealed with KMS, never shown back; no `default`) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
+| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key, password or other confidential value) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
 | `permissions.tools` | no | none | Up to 50 catalog names, such as `gmail.read`. Run `gravity tools` for the list. |
 | `permissions.models.tier` | no | `standard` | `standard` or `premium`. |
 | `approvals.required_for` | no | none | Tools that pause until a person approves. Each must also be declared under `permissions.tools` or a slot adapter. |
@@ -639,27 +656,6 @@ outputs:                          # extra formats the platform renders and deliv
 
 Unknown fields are rejected rather than ignored, so a typo is reported instead of silently dropped.
 
-### Secret inputs
-
-**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
-the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
-log and stored checkpoint, and decrypts it only to hand it to your running agent as
-`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
-holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
-calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
-manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
-to the user and stored in clear), and don't copy it into your own objects or logs: the platform
-can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
-the agent, they re-enter the key to change it; it is never shown back.
-
-```yaml
-inputs:
-  - name: supadata_api_key
-    type: secret
-    label: "Your Supadata API key"
-    required: true
-```
-
 ## An agent project
 
 ```
@@ -735,8 +731,9 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 
 ## What's new
 
-- **0.4.2** Documents `type: secret` (below) and the `supadata.get_transcript` tool.
-- **0.4.1** `type: secret` inputs: API keys and passwords the user enters are sealed with AWS KMS on the platform, never shown back, and handed only to the running agent. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
+- **0.4.4** Same code as 0.4.3, released from this repository so the GitHub release, the tag and PyPI line up again. Adds `RELEASING.md`.
+- **0.4.3** Documents the `secret` input type and the `supadata.get_transcript` tool.
+- **0.4.1** New input type `secret` for an API key, password or other confidential value. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
 
 ## Limitations
 
@@ -777,7 +774,7 @@ Every pull request and every push to `main` runs [`ci.yml`](.github/workflows/ci
 - both test suites on Ubuntu and Windows, with Python 3.12 and 3.13
 - a build of both packages, installed into a clean environment and used for real
 
-To release:
+To release, follow [RELEASING.md](RELEASING.md), which has every command and what to do when a step fails. In short:
 
 1. Set the new version in three places: `version` in `pyproject.toml`, `version` in `packages/gravity-schema/pyproject.toml`, and the `gravity-schema==` pin in `pyproject.toml`. Run `uv lock`, then merge to `main`.
 2. Tag the merge commit and push the tag. A tag containing `rc`, such as `v0.2.0rc1`, publishes to TestPyPI. Any other `v*` tag, such as `v0.2.0`, publishes to PyPI and creates a GitHub Release.

gravity_cli-0.4.2/PKG-INFO → gravity_cli-0.4.4/README.md

@@ -1,20 +1,3 @@
-Metadata-Version: 2.5
-Name: gravity-cli
-Version: 0.4.2
-Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
-License-Expression: Apache-2.0
-License-File: LICENSE
-License-File: NOTICE
-Requires-Python: >=3.12
-Requires-Dist: gravity-schema==0.4.2
-Requires-Dist: httpx>=0.27.0
-Requires-Dist: keyring>=25.0.0
-Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: rich>=13.9.0
-Requires-Dist: typer>=0.15.0
-Requires-Dist: uv>=0.8.0
-Description-Content-Type: text/markdown
-
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -642,7 +625,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
-| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key or password: masked, sealed with KMS, never shown back; no `default`) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
+| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key, password or other confidential value) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
 | `permissions.tools` | no | none | Up to 50 catalog names, such as `gmail.read`. Run `gravity tools` for the list. |
 | `permissions.models.tier` | no | `standard` | `standard` or `premium`. |
 | `approvals.required_for` | no | none | Tools that pause until a person approves. Each must also be declared under `permissions.tools` or a slot adapter. |
@@ -656,27 +639,6 @@ outputs:                          # extra formats the platform renders and deliv
 
 Unknown fields are rejected rather than ignored, so a typo is reported instead of silently dropped.
 
-### Secret inputs
-
-**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
-the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
-log and stored checkpoint, and decrypts it only to hand it to your running agent as
-`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
-holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
-calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
-manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
-to the user and stored in clear), and don't copy it into your own objects or logs: the platform
-can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
-the agent, they re-enter the key to change it; it is never shown back.
-
-```yaml
-inputs:
-  - name: supadata_api_key
-    type: secret
-    label: "Your Supadata API key"
-    required: true
-```
-
 ## An agent project
 
 ```
@@ -752,8 +714,9 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 
 ## What's new
 
-- **0.4.2** Documents `type: secret` (below) and the `supadata.get_transcript` tool.
-- **0.4.1** `type: secret` inputs: API keys and passwords the user enters are sealed with AWS KMS on the platform, never shown back, and handed only to the running agent. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
+- **0.4.4** Same code as 0.4.3, released from this repository so the GitHub release, the tag and PyPI line up again. Adds `RELEASING.md`.
+- **0.4.3** Documents the `secret` input type and the `supadata.get_transcript` tool.
+- **0.4.1** New input type `secret` for an API key, password or other confidential value. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
 
 ## Limitations
 
@@ -794,7 +757,7 @@ Every pull request and every push to `main` runs [`ci.yml`](.github/workflows/ci
 - both test suites on Ubuntu and Windows, with Python 3.12 and 3.13
 - a build of both packages, installed into a clean environment and used for real
 
-To release:
+To release, follow [RELEASING.md](RELEASING.md), which has every command and what to do when a step fails. In short:
 
 1. Set the new version in three places: `version` in `pyproject.toml`, `version` in `packages/gravity-schema/pyproject.toml`, and the `gravity-schema==` pin in `pyproject.toml`. Run `uv lock`, then merge to `main`.
 2. Tag the merge commit and push the tag. A tag containing `rc`, such as `v0.2.0rc1`, publishes to TestPyPI. Any other `v*` tag, such as `v0.2.0`, publishes to PyPI and creates a GitHub Release.

gravity_cli-0.4.4/RELEASING.md

@@ -0,0 +1,125 @@
+# Releasing gravity-cli and gravity-schema
+
+Both packages live in this repository and always ship together at the same version. The only way to publish is a tag on `main`. Nothing is uploaded to PyPI by hand.
+
+## 1. Make the change on a branch
+
+```bash
+git checkout main && git pull
+git checkout -b <your-branch>
+```
+
+Edit code, tests and docs. If you touched the manifest model in `packages/gravity-schema`, regenerate the committed JSON schema, or the schema tests fail:
+
+```bash
+cd packages/gravity-schema && uv run python -m gravity_schema && cd ../..
+```
+
+## 2. Check locally before you push
+
+```bash
+uv run ruff check .
+uv run pytest -q
+cd packages/gravity-schema && uv run pytest -q && cd ../..
+```
+
+All green, or it does not go up.
+
+## 3. Bump the version in both packages
+
+Three places must carry the same number:
+
+| File | Line |
+|---|---|
+| `pyproject.toml` | `version = "X.Y.Z"` |
+| `pyproject.toml` | `"gravity-schema==X.Y.Z"` under `dependencies` |
+| `packages/gravity-schema/pyproject.toml` | `version = "X.Y.Z"` |
+
+Then refresh the lockfile:
+
+```bash
+uv lock
+```
+
+Patch for fixes and docs, minor for new commands or manifest fields. Check PyPI first so a number is never reused:
+
+```bash
+curl -s https://pypi.org/pypi/gravity-cli/json | python -c "import sys,json;print(json.load(sys.stdin)['info']['version'])"
+```
+
+## 4. Open a pull request against `main`
+
+```bash
+git push -u origin <your-branch>
+gh pr create --base main
+```
+
+CI runs lint, package and the tests on Ubuntu and Windows with Python 3.12 and 3.13. Merge when green.
+
+## 5. Tag the merge commit on `main`
+
+```bash
+git checkout main && git pull
+git tag vX.Y.Z
+git push origin vX.Y.Z
+```
+
+The release workflow (`.github/workflows/release.yml`) then:
+
+1. checks the tag against both versions and the pin, and stops if any disagree;
+2. reruns the full CI;
+3. builds both wheels and sdists;
+4. publishes to PyPI through trusted publishing, schema first, then CLI;
+5. creates the GitHub release with the four files attached.
+
+Watch it:
+
+```bash
+gh run list --workflow release.yml --limit 1
+gh run watch <run-id>
+```
+
+## 6. Verify from a clean install
+
+```bash
+uv tool install --force --refresh gravity-cli==X.Y.Z
+gravity whoami
+```
+
+## Dry run on TestPyPI
+
+Any tag containing `rc` publishes to TestPyPI instead of PyPI:
+
+```bash
+git tag vX.Y.Zrc1 && git push origin vX.Y.Zrc1
+```
+
+Use this when you change the workflow itself or the packaging.
+
+## If something goes wrong
+
+**The guard fails with "tag says X but version is Y".** You tagged before bumping. Delete the tag, fix the versions, retag.
+
+```bash
+git tag -d vX.Y.Z && git push origin :refs/tags/vX.Y.Z
+```
+
+**A job fails on "other side closed" or a download error.** A GitHub hiccup. Rerun the failed jobs, nothing else is needed.
+
+```bash
+gh run rerun <run-id> --failed
+```
+
+**Publish fails with "file already exists".** That version is already on PyPI and cannot be overwritten. Bump and release again.
+
+**Wrong code shipped.** Do not delete the PyPI release. Ship a fixed version on top, and yank the bad one on PyPI only if it is harmful.
+
+## Rules
+
+- No copies of the source in other repositories. Pin the PyPI version in your requirements instead.
+- No PyPI API tokens. The trusted publisher configured for this repository is the only credential. If you hold a token for either package, say so and it gets revoked.
+- Every change is a pull request, however small. Review turnaround is same day.
+
+## Record
+
+Versions 0.4.1 to 0.4.3 were published to PyPI on 2026-10-08 from a copy of this source kept in the core repository. Their changes were ported back in PR #11. This repository has no tag or GitHub release for them, and the next release from here is 0.4.4.

{gravity_cli-0.4.2 → gravity_cli-0.4.4}/packages/gravity-schema/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gravity-schema"
-version = "0.4.2"
+version = "0.4.4"
 description = "Gravity agent manifest contract — models, validation, and JSON Schema export"
 readme = "README.md"
 license = "Apache-2.0"

{gravity_cli-0.4.2 → gravity_cli-0.4.4}/packages/gravity-schema/tests/test_manifest.py

@@ -624,3 +624,12 @@ def test_state_size_outside_bounds_rejected(manifest_data, bad):
 def test_runtime_python_defaults_to_313(manifest_data):
     del manifest_data["runtime"]["python"]
     assert validate_manifest(manifest_data).runtime.python == "3.12"
+
+
+def test_a_secret_input_cannot_have_a_default(manifest_data):
+    manifest_data["inputs"] = [{"name": "api_key", "type": "secret", "label": "Key", "default": "sk-x"}]
+    with pytest.raises(ManifestValidationError) as e:
+        validate_manifest(manifest_data)
+    assert "cannot have a default" in str(e.value)
+    del manifest_data["inputs"][0]["default"]
+    assert validate_manifest(manifest_data).inputs[0].type.value == "secret"

{gravity_cli-0.4.2 → gravity_cli-0.4.4}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "gravity-cli"
-version = "0.4.2"
+version = "0.4.4"
 description = "gravity cli — init, run, and push python agents to the Gravity marketplace"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.12"
 dependencies = [
-    "gravity-schema==0.4.2",  # released in lockstep: always the same version as this package
+    "gravity-schema==0.4.4",  # released in lockstep: always the same version as this package
     "typer>=0.15.0",
     "httpx>=0.27.0",
     "rich>=13.9.0",

{gravity_cli-0.4.2 → gravity_cli-0.4.4}/src/gravity_cli/BUILDER_GUIDE.md

@@ -127,16 +127,8 @@ keeps the digest as a draft for the user to send. That's why the fallback in §3
 Other input fields you can use: `default:` (a value if the user leaves it blank; not for `file`),
 `options: [a, b]` (for `static-dropdown`), `accept: [pdf, csv]` (for `file`).
 
-**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
-the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
-log and stored checkpoint, and decrypts it only to hand it to your running agent as
-`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
-holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
-calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
-manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
-to the user and stored in clear), and don't copy it into your own objects or logs: the platform
-can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
-the agent, they re-enter the key to change it; it is never shown back.
+**API keys, passwords and other confidential values: use `type: secret`**, never `text`. A secret
+input cannot have a `default`.
 
 ### 3.2 `requirements.txt`
 

{gravity_cli-0.4.2 → gravity_cli-0.4.4}/uv.lock

@@ -164,7 +164,7 @@ wheels = [
 
 [[package]]
 name = "gravity-cli"
-version = "0.4.2"
+version = "0.4.4"
 source = { editable = "." }
 dependencies = [
     { name = "gravity-schema" },
@@ -201,7 +201,7 @@ dev = [
 
 [[package]]
 name = "gravity-schema"
-version = "0.4.2"
+version = "0.4.4"
 source = { editable = "packages/gravity-schema" }
 dependencies = [
     { name = "pydantic" },

gravity_cli-0.4.2/dist-schema/.gitignore

@@ -1 +0,0 @@
-*